#!/bin/sh
set -eu

DATA_DIR="${APPOPS_DATA_DIR:-/data}"
mkdir -p "$DATA_DIR"

generate_service_token() {
  enabled="$1"
  token_value="$2"
  token_file="$3"
  if [ "$enabled" = "true" ] && [ -z "$token_value" ]; then
    if [ ! -s "$token_file" ]; then
      umask 077
      python -c 'import secrets; print(secrets.token_urlsafe(48))' > "$token_file"
    fi
    chmod 600 "$token_file"
  fi
}

generate_service_token "${APPOPS_ENABLE_MCP:-false}" "${APPOPS_MCP_TOKEN:-}" "${APPOPS_MCP_TOKEN_FILE:-${DATA_DIR}/mcp-token}"
generate_service_token "${APPOPS_ENABLE_N8N:-false}" "${APPOPS_N8N_TOKEN:-}" "${APPOPS_N8N_TOKEN_FILE:-${DATA_DIR}/n8n-token}"
generate_service_token "true" "${APP_OPS_VOICE_TOKEN:-}" "${APP_OPS_VOICE_TOKEN_FILE:-${DATA_DIR}/voice-token}"

OWNER_MARKER="${DATA_DIR}/.appops-owner-v1"
if [ ! -f "$OWNER_MARKER" ]; then
  chown -R appops:appops "$DATA_DIR"
  touch "$OWNER_MARKER"
fi
chown appops:appops "$DATA_DIR" "$OWNER_MARKER"
for token_file in \
  "${APPOPS_AUTHENTIK_CLIENT_SECRET_FILE:-${DATA_DIR}/authentik-oidc-secret}" \
  "${APPOPS_ENTRA_CLIENT_SECRET_FILE:-${DATA_DIR}/entra-oidc-secret}" \
  "${APP_OPS_VOICE_TOKEN_FILE:-${DATA_DIR}/voice-token}" \
  "${APPOPS_MCP_TOKEN_FILE:-${DATA_DIR}/mcp-token}" \
  "${APPOPS_N8N_TOKEN_FILE:-${DATA_DIR}/n8n-token}"; do
  [ ! -e "$token_file" ] || chown appops:appops "$token_file"
done

exec gosu appops "$@"